What the media trade must learn about California's upcoming new privateness legislation
Aside from the drama of the U.S. presidential election and the potential impact those results may have on big tech, digital marketers will be paying attention to a more local California election initiative that puts privacy first.
Proposition 24, the Consumer Privacy Rights Act, is about to be passed, with 56% – or 6.3 million California residents – voting in favor, 44% (4.96 million) against. The results will be confirmed by December 11th.
CPRA is essentially a revision of the pre-existing California Data Protection Act, which is already considered the most comprehensive US data protection act. It focuses on a number of core principles that have been endorsed by a host of high profile privacy advocates, including former hopeful President Andrew Yang.
Core principles of the CPRA
- Stronger protection of the personal information of California residents, including ethnicity, financial, genetic, geographic, health, personal communications, race, religion, sexual orientation, and union membership
- More safeguards for informing minors, including an opt-in request to sell data from consumers under the age of 16 and tripling the maximum penalties for violations
- Tighter restrictions on the potential for lobbyists to water down the privacy practices adopted by California residents, including measures to prevent the retention of sensitive information
- Establishing a California Data Protection Authority to enforce the above requirements, funded with up to $ 10 million per year
Efforts to dilute CCPA
The CCPA revisions, which only became enforceable in July, are the result of efforts by noted data protection officer, Alastair Mctaggart, who was allegedly frustrated with the efforts to water down the CCPA passed by lawmakers in 2018.
Omer Tene, Chief Knowledge Officer and vp at the consumer protection agency IAPP, told Adweek that additional provisions for reporting data protection violations and the right to correct inaccurate data retention are among the most important changes.
"I think on a high level, I would say that this bill greatly expands the scope of CCPA," he said.
Tene went on to explain that many companies have tried to position their treatment of consumer information as "don't sell data" since CCPA was incorporated into law in 2018 – a definition that would exempt them from consent under the GDPR.
“Alastair Mctaggart was upset that many companies had worked hard over the past year and a half to water down some of the CCPA's provisions. The fact that it is an electoral initiative will make it difficult for them to do so. "
Jason Kint, CEO of a retail organization representing premium publishers called Digital Content Next, told Adweek that the renewed protocols would favor those that are directly related to consumers, while undermining the monetization capabilities of some big-name names on the internet.
"It clearly closes off some areas where big companies like Google and Facebook continue to track users and collect data," he said. "If you look at some of the previous research, Facebook and Google collect most of their data as third parties on other people's properties. This limits that."
How companies should prepare for CPRA
Sources told Adweek that those in the digital media ecosystem should prepare for CPRA by looking at the reinforced definition of what "personal information" is and which partners in their supply chain have access to it.
Celine Guillou, attorney at California-based law firm Hopkins Barley, told Adweek that CPRA's definition of sensitive information is broader than GDPR. "And CPRA would like to add a new button (to a specific website) via 'Don't sell my data', which fundamentally restricts the processing of confidential information."